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IN THE CLAIMS : 

Please cancel claims 1-5, 7-12, and 14-20 without prejudice. 

Please amend claims 6 and 13 as follows: 
1-5. (Canceled) 

6. (Currently Amended) ¥he A method of claim 5, for identifying spoofed emails, the method 
comprising the steps of: 

receiving an email addressed to a recipient in a first network, the email including a plurality 
of headers, wherein at least one of the plurality of headers includes a sender address; 

determining whether the sender address indicates a mailbox from within the first network; 

when the sender address indicates a mailbox from within the first network, modifying at least 
a portion of the sender address so as to produce a modified sender address that indicates to the 
recipient that the email is associated with a mailbox that is external to the first network; and 

sending the email with the modified sender address to the recipient, the modified sender 
address being visible to the recipient, 

wherein the step of determining comprises: 

determining whether the sender address matches any one of a plurality of domains or 

sub-domains associated with the first network, and 

the step of modifying comprises: 

modifying the sender address when the sender address matches any one of the 

domains or sub-domains associated with the first network. 



7-12. (Canceled) 
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13. (Currently Amended) The A tangible computer readable storage medium of claim 10, 
encoded with a program for identifying spoofed emails, the program comprising instructions for 
performing a method comprising the steps of: 

receiving an email addressed to a recipient in a first network, the email including a plurality 
of headers, wherein at least one of the plurality of headers includes a sender address; 

determining whether the sender address indicates a mailbox from within the first network; 

when the sender address indicates a mailbox from within the first network, modifying at least 
a portion of the sender address so as to produce a modified sender address that indicates to the 
recipient that the email is associated with a mailbox that is external to the first network; and 

sending the email with the modified sender address to the recipient, the modified sender 
address being visible to the recipient, 

wherein the determining step of the method comprises determining whether the sender 
address matches any one of a plurality of domains or sub-domains associated with the first network, 
and 

the modifying step of the method comprises modifying the sender address when the sender 
address matches any one of the domains or sub-domains associated with the first network. 

14-20. (Canceled) 



